Examkin

Question

Difficulty: Very hardIdentity and Access Management (IAM) Roles and Resource Hierarchy

A enterprise security architect is auditing access control evaluation for a Google Cloud environment structured with an Organization node, nested Department and Environment Folders, Workload Projects, and Cloud Storage resources. A user requests `storage.objects.get` on a specific bucket. To verify permission resolution and troubleshoot unexpected access results, the architect must trace the exact sequence of Google Cloud Identity and Access Management (IAM) policy evaluation logic.

In what exact sequence does Google Cloud IAM process policy rules and resource hierarchy grants to determine if the user is authorized to perform the action?

  1. 1Evaluate IAM Deny policies applied across the resource hierarchy (Organization, Folders, and Project) to check for any explicit deny rules matching the principal and permission.
  2. 2Gather inherited IAM Allow role bindings attached at the Organization level and evaluate permissions downward through parent Folder nodes.
  3. 3Gather IAM Allow role bindings assigned directly at the specific Project node containing the target Cloud Storage resource.
  4. 4Gather resource-level IAM Allow role bindings assigned directly on the target Cloud Storage Bucket resource.
  5. 5Compute the effective permission set as the union of all inherited and direct Allow role bindings, granting access if the requested permission is present and not denied.

Answer

The correct evaluation order begins with checking IAM Deny policies across all hierarchy levels, followed by collecting IAM Allow bindings top-down from the Organization node, through parent Folders, at the Project node, and finally on the target Resource, concluding with computing the union of all Allow permissions to authorize the request.
Google Cloud evaluates authorization by first checking IAM Deny policies across all ancestral nodes (Organization, Folders, Project). If no Deny rule applies, IAM collects Allow permissions top-down starting from the Organization root node, continuing through parent Folders, down to the Project node, and ending at the target Cloud Storage Bucket resource. Finally, it calculates the union of all granted Allow permissions; if the required permission is present, access is granted.

Step-by-Step Solution

1
Check for IAM Deny overrides across the resource hierarchy.
Confirm that no IAM Deny policy defined at the Organization, Folder, or Project level explicitly blocks `storage.objects.get` for the requesting principal.
Google Cloud IAM enforces Deny policies prior to evaluating any Allow rules. An applicable Deny rule short-circuits evaluation and halts execution with an access denied result.
2
Evaluate top-down inherited IAM Allow permissions from the Organization and Folder nodes.
Collect Allow role bindings inherited from ancestor nodes in the hierarchy tree.
Permissions granted at higher levels in the GCP resource hierarchy automatically propagate down to all child resources due to resource hierarchy inheritance.
3
Evaluate project-level IAM Allow permissions.
Add role bindings granted at the Project containing the target bucket to the candidate permission set.
Project-level role grants complement higher-level folder and organization policies for all resources inside that specific project.
4
Evaluate target resource-level IAM Allow permissions.
Add role bindings defined directly on the Cloud Storage Bucket.
Resource-level IAM policies allow fine-grained access control on individual resources at the leaf node of the hierarchy.
5
Calculate effective authorization by taking the union of all collected Allow permissions.
Authorize the API call if the required permission `storage.objects.get` is contained within the resulting permission set.
IAM permissions in GCP are additive. If any valid Allow binding at any level grants the required permission, and no Deny rule blocks it, access is approved.

Key Concept

Google Cloud IAM Policy Evaluation and Resource Hierarchy Inheritance
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy